Kernel. Modules, program exec, syscalls, elf

man 2 syscalls

system_call()

strace -e trace=open date
strace -c date

ltrace -T -S rmdir t
ltrace -c -S rmdir t

ldd `which python`

Elf

# view headers, section...
readelf -a a.out
readelf --sections=vmlinux a.out
readelf --dynamic a.out

# disassembly
objdump -M intel -S a.out

# list symbols from object files
nm a.out

# dependencies resolved from this list
cat /proc/kallsyms | grep printk

cat /boot/System.map-3.13.0 | grep printk

stat a.out
file a.out

Modules

# list modules
lsmod

# Modules dependencies
cat /lib/modules/3.12.7/modules.dep | grep vboxdrv
man depmod

# info
modinfo vboxdrv

# view system device information
systool -v -m vboxdrv

struct module
sys_init_module() -> load_module()
sys_delete_module()
request_module()
hello world module

man 2 init_module
man 2 delete_module

# which module loader
cat /proc/sys/kernel/modprobe
sudo sysctl -a | grep modprobe

man modprobe
man insmod
man rmmod

ll /sbin/udevd

udevadm monitor

cat /proc/sys/kernel/taintined
dmesg | grep taint